What are the Latest GLBA Requirements for Financial Services Firms in 2026?

By Ken Satkunam, CISM  ·  President & Founder, NorthStar Technology Group

March 2026  ·  10 min read

 

The Gramm-Leach-Bliley Act (GLBA) is the cornerstone data privacy and security law for U.S. financial institutions, mandating strict requirements for safeguarding consumer information. With evolving cyber threats and new federal guidance, 2026 brings significant updates and renewed scrutiny to GLBA compliance for banks, credit unions, accounting firms, registered investment advisors, insurance companies, and any business labeled as a "financial institution" under federal law. This article explores exactly what GLBA requires in 2026, who must comply, how the latest regulatory changes affect data protection and risk management, and what practical steps organizations should take to avoid penalties, ensure consumer trust, and maintain compliance.

What is GLBA and Who Must Comply in 2026?

The Gramm-Leach-Bliley Act (GLBA), enacted in 1999, governs the way financial institutions protect consumer information. It applies to a wide array of organizations, not just traditional banks. The Federal Trade Commission (FTC), federal banking agencies, and other regulators enforce GLBA. In 2026, GLBA’s scope includes:

• Banks of all sizes, savings and loan associations, and credit unions
• Accounting and CPA firms handling finances or tax preparation for clients
• Registered Investment Advisors (RIAs), broker-dealers, and wealth managers
• Insurance firms, agencies, and agents
• Mortgage brokers and originators
• Auto dealers engaged in consumer lending or leasing

According to ftc.gov, a financial institution is broadly defined as any company "significantly engaged" in providing financial products or services to consumers.

Any organization that stores, processes, transmits, or accesses personally identifiable financial information of consumers or clients falls under GLBA. Even if your company is not a bank, if you are handling consumer finance information—such as accounting firms preparing tax returns or insurance companies reviewing applications—you must comply. For a deep dive into how accounting firms in particular are regulated, visit our Financial Services Resources hub.

What are the Core GLBA Requirements for Data Security in 2026?

GLBA compliance consists of three main rules:

1. The Financial Privacy Rule: Requires institutions to provide consumers with a clear, conspicuous privacy notice explaining what information is collected, how it is used, and with whom it is shared.
2. The Safeguards Rule: Mandates that organizations develop, implement, and maintain a comprehensive written information security program (WISP) appropriate for their size, complexity, and data sensitivity.
   • This includes technical, physical, and administrative safeguards.
3. The Pretexting Provisions: Prohibit the use of false pretenses, such as phishing or social engineering, to obtain customer information.

While the basics have remained stable, the FTC’s revised Safeguards Rule (effective dates extended into 2024-2025) has raised the bar for what is expected in information security, requiring more specificity in risk assessments, vendor management, encryption, incident response, and board reporting.

In 2026, enforcement agencies are emphasizing:

• Documented, recurring risk assessments
• Strong authentication, ongoing vulnerability management, and system monitoring
• Encryption of customer data at rest and in transit
• Secure development practices and change management for financial applications
• Third-party (vendor) cybersecurity vetting and contract controls
• Incident response plans and mandatory breach notification procedures
• Employee cybersecurity awareness and data protection training
• Annual reporting to a qualified board or equivalent governing body

These requirements apply to diverse financial firms, from small accounting practices to large regional banks. For sample documentation and actionable steps, explore our managed security for financial services.

How Have GLBA Requirements Changed Recently?

GLBA has always aimed to protect consumers’ financial privacy, but in response to the digitalization of financial services and relentless cyber threats, regulators have updated and tightened expectations. Key updates and trends for 2026:

• Revised Safeguards Rule: As revised by the FTC, mandates more granular risk assessments, written incident response plans, designated security program managers, and enhanced technical controls. Enforcement has increased for smaller entities, including non-bank institutions and accounting firms.
• Maturity Expectation: The Federal Financial Institutions Examination Council (FFIEC) now expects a risk-based, maturity-model approach. This means periodic control testing, continual process improvement, and dynamic adaptation of controls—not static programs.
• Vendor Oversight: Institutions must prove their third-party service providers handle information appropriately, with contracts, due diligence, and continuous monitoring.
• Mandatory Encryption: Encryption of data at rest and in transit is a new bright line, with few allowable exceptions. This extends to cloud storage, backups, and third-party software tools.
• Incident Response and Notification: Clear, documented procedures must be in place for responding to data breaches and cyberattacks, including communication with regulatory authorities and customers as required by state breach notification laws.
• Training for All Personnel: Annual, role-based information security training is required for all staff, not just IT personnel.

The emergence of new technologies, such as AI-enabled fraud and ransomware, underscores the need for continuous monitoring and response capabilities. For related challenges and countermeasures, see our recent articles: Ransomware Defense for Financial Organizations and Agentic AI for Law Firms.

What Steps Should Financial Firms Take to Ensure GLBA Compliance in 2026?

The most successful compliance programs are systematic and proactive. Here is a detailed roadmap for GLBA compliance as of 2026:

1. Appoint a Qualified Security Program Manager: GLBA requires a designated individual or team responsible for implementing, reviewing, and enforcing the WISP. For many firms, this means engaging a vCISO or managed security provider, especially where full-time security staff are impractical.
2. Conduct a Written Risk Assessment:
   Identify systems, data flows, and threats; evaluate likelihood and impact; document and update the assessment annually or when material changes occur.
3. Develop and Maintain a Written Information Security Program (WISP):
   Your WISP must describe policies, controls, and procedures addressing regulatory mandates, tailored to the organization’s complexity and risk.
4. Implement Technical Safeguards:
   • Multifactor authentication (MFA) for all remote and privileged access
   • Encryption for all customer information, both in transit and at rest
   • Patch management and system hardening — ensure systems are continuously updated
   • Ongoing vulnerability scanning and pen testing
   • 24/7 monitoring and logging of access to sensitive data
5. Strengthen Vendor Risk Management:
   Establish risk-based due diligence, formal contracts requiring GLBA-level controls, and periodic reviews of service provider security posture.
6. Prepare an Incident Response Plan:
   • Document escalation procedures for security incidents
   • Handle data breach notification and regulatory reporting processes
   • Regularly test and update the plan through tabletop exercises
7. Train Employees Annually: Focus on phishing, social engineering, cloud usage policies, and your WISP requirements. Use scenario-based and role-based modules to address varied risks, especially for remote staff.
8. Annual Board or Partner Reporting: Provide written reports to board directors or firm principals summarizing the state of security, key risks, program updates, and material incidents.

Detailed checklists, sample policies, and consultation are available at our Financial Services Security page. For a self-assessment against your current maturity, try our free security check tool.

What Risks Do Organizations Face for Non-Compliance?

GLBA penalties are severe and often accompanied by reputational damage, class-action lawsuits, and customer attrition. Regulatory enforcement actions averaged $1.3 million per incident in 2025 for financial firms found lacking in GLBA compliance. Recent federal consent orders also call for:

• Mandatory corrective actions and outside audits
• Broad public notification of compliance failures
• Ongoing monitoring by federal or state authorities
• Potential civil litigation from customers or clients affected by data breaches

Beyond fines, business impacts include increased cyber insurance premiums, loss of clients, and difficulties in partner integrations due to a failed due diligence review. For an overview of cyber insurance’s interplay with regulatory requirements, see our prior article: Cyber Insurance Trends for Financial Firms 2026.

The AICPA advises that accounting and CPA firms, in particular, take a risk-based approach and anticipate scrutiny even if the number of consumer customers is small. RIAs should monitor both SEC and FTC developments for dual regulatory risks.

How Do GLBA Requirements Overlap with the FTC Safeguards Rule, SOC 2, and State Laws?

GLBA and the FTC Safeguards Rule are closely intertwined. The Safeguards Rule, updated most recently in 2024, is an explicit extension of GLBA, spelling out what "appropriate safeguards" mean in practice. Organizations that comply with the Safeguards Rule are well on their way to meeting GLBA’s intent.

SOC 2, mapped to the AICPA’s Trust Services Criteria, intersects with GLBA on security, confidentiality, and privacy controls. Achieving a SOC 2 attestation brings important overlap with GLBA requirements but is not a substitute. Rigorous controls, regular audits, and documented evidence are needed for both frameworks; see our overview at SOC 2 for Financial Services: Requirements & Best Practices.

Many states have enacted privacy and breach notification laws, such as the NY Department of Financial Services (NY DFS) Cybersecurity Regulation, that raise the bar above minimum GLBA standards. If you operate in or serve clients in multiple states, your compliance program must harmonize GLBA, state, and possibly contractual or cyber insurance mandates. For guidance on medical and other regulated data, see our coverage of HIPAA Security Rule 2025 updates.

Where Can Financial Firms Get Help With GLBA Compliance?

GLBA compliance is more than a checklist—it is a living risk management process. Few internal IT or compliance teams are adequately resourced to address all required areas, especially in small or midsize businesses or multi-branch firms. To address these needs, managed IT and cybersecurity partners such as NorthStar Technology Group offer:

• Security program assessments and gap analysis versus GLBA and FTC requirements
• Custom WISP development and vulnerability remediation plans
• Ongoing technical services: endpoint security, SIEM/SOC monitoring, managed cloud security
• Vendor risk management (VRM) and outsourced due diligence reviews
• Staff training, phishing simulation, and security policy enforcement
• Incident response retainers and breach investigation expertise

For case studies, best practices, and complimentary compliance toolkits, visit our Financial Services Resource Center. If you are unsure of your status, start with a free GLBA security check or contact us for a comprehensive gap assessment.

 

ABOUT THE AUTHOR

Ken Satkunam, CISM
President & Founder, NorthStar Technology Group

Ken has spent over 25 years in IT leadership serving regulated organizations. He founded NorthStar Technology Group in 2000 and holds the CISM credential from ISACA. NorthStar has been recognized on the Inc. 5000 list in 2024 (#3837) and 2025 (#2393). Ken is the co-author of the Amazon best-seller Cyber Attack Prevention.

CISM • Inc. 5000 • MSP 500 • Published Author • 25+ Years